TITAN AI · AZURE LIVE SCAN
AZL-20260426-132706
Customer: TITAN AI Live Demo · Subscription: Pay-As-You-Go · Resource Group: rg-titandemo-260426-1324
Generated: 2026-04-26T13:27:06.7408698-05:00
Attack Path Analysis
Reachability + Blast Radius
| ATTACK PATHS COMPUTED | 8 |
|---|
| DOWNSTREAM RESOURCES AT RISK | 5 |
|---|
| COMPOUND-RISK RESOURCES | 3 |
|---|
RESOURCES WITH MULTIPLE FINDINGS
satitandemo2604261324 — 3 findings stackednsg-titandemo-public — 3 findings stackedkv-titandemo-260426-1324 — 2 findings stacked
Findings (8)
P2
CRITICAL
nsg_open_to_internet
open
SSH exposed to 0.0.0.0/0
| RESOURCE | nsg-titandemo-public/BAD-allow-ssh-from-internet |
|---|
| HIPAA CITATION | HIPAA 164.312(e)(1) Transmission Security |
|---|
| RECOMMENDATION | Restrict source to corporate IP ranges or remove rule entirely. |
|---|
| PRIORITY | P2 · Fix in 72 hours — risk score 50/100 |
|---|
| RISK FACTORS | Internet-facing · Business-critical |
|---|
| MITRE ATT&CK | T1133 - External Remote Services |
|---|
| ATTACK PATH | Internet → NSG nsg-titandemo-public → Subnet/NIC → Workload VM |
|---|
| PATH LENGTH | 3 hops |
|---|
| COMPOUND RISK | 2 other finding(s) on the same resource — multiplier 2x |
|---|
| DETECTED AT | 2026-04-26T13:27:02.1133696-05:00 |
|---|
| FIX APPLIED | False |
|---|
REMEDIATION PLAYBOOK · OWNER: Network/Security · ESTIMATED EFFORT: 24-72 hours
- Identify which subnet/NIC the NSG attaches to (Get-AzNetworkSecurityGroup)
- Replace 0.0.0.0/0 source with corporate CIDR ranges or VPN gateway
- Update Azure Firewall + Bastion if RDP/SSH access still needed
- Re-scan to verify rule removed
- Document change in CAB ticket
P2
CRITICAL
nsg_open_to_internet
open
RDP exposed to 0.0.0.0/0
| RESOURCE | nsg-titandemo-public/BAD-allow-rdp-from-internet |
|---|
| HIPAA CITATION | HIPAA 164.312(e)(1) Transmission Security |
|---|
| RECOMMENDATION | Restrict source to corporate IP ranges or remove rule entirely. |
|---|
| PRIORITY | P2 · Fix in 72 hours — risk score 50/100 |
|---|
| RISK FACTORS | Internet-facing · Business-critical |
|---|
| MITRE ATT&CK | T1133 - External Remote Services |
|---|
| ATTACK PATH | Internet → NSG nsg-titandemo-public → Subnet/NIC → Workload VM |
|---|
| PATH LENGTH | 3 hops |
|---|
| COMPOUND RISK | 2 other finding(s) on the same resource — multiplier 2x |
|---|
| DETECTED AT | 2026-04-26T13:27:02.1292853-05:00 |
|---|
| FIX APPLIED | False |
|---|
REMEDIATION PLAYBOOK · OWNER: Network/Security · ESTIMATED EFFORT: 24-72 hours
- Identify which subnet/NIC the NSG attaches to (Get-AzNetworkSecurityGroup)
- Replace 0.0.0.0/0 source with corporate CIDR ranges or VPN gateway
- Update Azure Firewall + Bastion if RDP/SSH access still needed
- Re-scan to verify rule removed
- Document change in CAB ticket
P2
CRITICAL
nsg_open_to_internet
open
SQL Server exposed to 0.0.0.0/0
| RESOURCE | nsg-titandemo-public/BAD-allow-sql-from-internet |
|---|
| HIPAA CITATION | HIPAA 164.312(e)(1) Transmission Security |
|---|
| RECOMMENDATION | Restrict source to corporate IP ranges or remove rule entirely. |
|---|
| PRIORITY | P2 · Fix in 72 hours — risk score 50/100 |
|---|
| RISK FACTORS | Internet-facing · Business-critical |
|---|
| MITRE ATT&CK | T1133 - External Remote Services |
|---|
| ATTACK PATH | Internet → NSG nsg-titandemo-public → Subnet/NIC → Workload VM |
|---|
| PATH LENGTH | 3 hops |
|---|
| COMPOUND RISK | 2 other finding(s) on the same resource — multiplier 2x |
|---|
| DETECTED AT | 2026-04-26T13:27:02.1533773-05:00 |
|---|
| FIX APPLIED | False |
|---|
REMEDIATION PLAYBOOK · OWNER: Network/Security · ESTIMATED EFFORT: 24-72 hours
- Identify which subnet/NIC the NSG attaches to (Get-AzNetworkSecurityGroup)
- Replace 0.0.0.0/0 source with corporate CIDR ranges or VPN gateway
- Update Azure Firewall + Bastion if RDP/SSH access still needed
- Re-scan to verify rule removed
- Document change in CAB ticket
P1
CRITICAL
storage_public_blob
open
Anonymous blob access enabled (PHI exposure risk)
| RESOURCE | satitandemo2604261324 |
|---|
| HIPAA CITATION | HIPAA 164.502 Uses and Disclosures |
|---|
| RECOMMENDATION | Set AllowBlobPublicAccess=false. |
|---|
| PRIORITY | P1 · Fix in 24 hours — risk score 75/100 |
|---|
| RISK FACTORS | Internet-facing · PHI exposure · Business-critical |
|---|
| MITRE ATT&CK | T1530 - Data from Cloud Storage |
|---|
| ATTACK PATH | Internet → Public Blob Endpoint → PHI/PII Container |
|---|
| PATH LENGTH | 1 hops |
|---|
| BLAST RADIUS | 1 storage_account(s): satitandemo2604261324 |
|---|
| COMPOUND RISK | 2 other finding(s) on the same resource — multiplier 2x |
|---|
| DETECTED AT | 2026-04-26T13:27:02.9928748-05:00 |
|---|
| FIX APPLIED | False |
|---|
REMEDIATION PLAYBOOK · OWNER: Storage Owner + Privacy · ESTIMATED EFFORT: 1-2 days
- Set-AzStorageAccount -AllowBlobPublicAccess $false on the storage account
- Audit storage diagnostic logs (last 90 days) for any anonymous reads
- If access detected on PHI containers: trigger HIPAA breach assessment within 60 days
- Enable Azure Defender for Storage (continuous threat detection)
- Configure Storage Firewall: PublicNetworkAccess=Disabled, allowlist VNet subnets
P2
HIGH
storage_http_allowed
open
HTTP traffic allowed - PHI in transit not encrypted
| RESOURCE | satitandemo2604261324 |
|---|
| HIPAA CITATION | HIPAA 164.312(e)(2)(ii) Encryption |
|---|
| RECOMMENDATION | Set EnableHttpsTrafficOnly=true. |
|---|
| PRIORITY | P2 · Fix in 72 hours — risk score 50/100 |
|---|
| RISK FACTORS | PHI exposure · Business-critical |
|---|
| MITRE ATT&CK | T1040 - Network Sniffing |
|---|
| ATTACK PATH | Internet → Public Blob Endpoint → PHI/PII Container |
|---|
| PATH LENGTH | 1 hops |
|---|
| BLAST RADIUS | 1 storage_account(s): satitandemo2604261324 |
|---|
| COMPOUND RISK | 2 other finding(s) on the same resource — multiplier 2x |
|---|
| DETECTED AT | 2026-04-26T13:27:03.0096734-05:00 |
|---|
| FIX APPLIED | False |
|---|
REMEDIATION PLAYBOOK · OWNER: Storage Owner · ESTIMATED EFFORT: Same day
- Set-AzStorageAccount -EnableHttpsTrafficOnly $true
- Verify clients support TLS 1.2+ (legacy SDKs may break)
- Re-scan to confirm
- Update IaC template (Bicep/Terraform) so it doesn't drift back
- Document change
P1
HIGH
storage_public_network
open
Storage exposed to all networks (no firewall)
| RESOURCE | satitandemo2604261324 |
|---|
| HIPAA CITATION | HIPAA 164.312(c)(1) Integrity Controls |
|---|
| RECOMMENDATION | Set PublicNetworkAccess=Disabled or configure NetworkRuleSet. |
|---|
| PRIORITY | P1 · Fix in 24 hours — risk score 75/100 |
|---|
| RISK FACTORS | Internet-facing · PHI exposure · Business-critical |
|---|
| MITRE ATT&CK | T1530 - Data from Cloud Storage |
|---|
| ATTACK PATH | Internet → Public Blob Endpoint → PHI/PII Container |
|---|
| PATH LENGTH | 1 hops |
|---|
| BLAST RADIUS | 1 storage_account(s): satitandemo2604261324 |
|---|
| COMPOUND RISK | 2 other finding(s) on the same resource — multiplier 2x |
|---|
| DETECTED AT | 2026-04-26T13:27:03.0212220-05:00 |
|---|
| FIX APPLIED | False |
|---|
REMEDIATION PLAYBOOK · OWNER: Storage Owner + Network · ESTIMATED EFFORT: 1-3 days
- Identify all consumers of this storage account (find downstream apps/services)
- Configure NetworkRuleSet with VNet allowlist + IP allowlist for build agents
- Set PublicNetworkAccess=Disabled
- Use Private Endpoints for service-to-service traffic
- Re-scan + verify clients still connect via private path
P1
HIGH
keyvault_public_network
open
Key Vault exposed to public network
| RESOURCE | kv-titandemo-260426-1324 |
|---|
| HIPAA CITATION | HIPAA 164.312(a)(1) Access Control |
|---|
| RECOMMENDATION | Set PublicNetworkAccess=Disabled and use private endpoint. |
|---|
| PRIORITY | P1 · Fix in 24 hours — risk score 75/100 |
|---|
| RISK FACTORS | Internet-facing · PHI exposure · Business-critical |
|---|
| MITRE ATT&CK | T1528 - Steal Application Access Token |
|---|
| ATTACK PATH | Internet → Key Vault Public Endpoint → Secrets/Keys/Certs |
|---|
| PATH LENGTH | 1 hops |
|---|
| BLAST RADIUS | 1 key_vault(s): kv-titandemo-260426-1324 |
|---|
| COMPOUND RISK | 1 other finding(s) on the same resource — multiplier 1.5x |
|---|
| DETECTED AT | 2026-04-26T13:27:04.8879770-05:00 |
|---|
| FIX APPLIED | False |
|---|
REMEDIATION PLAYBOOK · OWNER: Security + App Owner · ESTIMATED EFFORT: 1-2 days
- Inventory which apps/Functions reference secrets in this Key Vault
- Set PublicNetworkAccess=Disabled and configure Private Endpoint
- Update consumer apps to use Private Endpoint DNS
- Test secret retrieval from each consumer
- Re-scan
P3
MEDIUM
keyvault_no_purge_protection
open
Purge protection disabled - keys can be permanently deleted
| RESOURCE | kv-titandemo-260426-1324 |
|---|
| HIPAA CITATION | HIPAA 164.308(a)(7) Contingency Plan |
|---|
| RECOMMENDATION | Enable purge protection. |
|---|
| PRIORITY | P3 · Fix in next sprint (2 weeks) — risk score 25/100 |
|---|
| RISK FACTORS | Business-critical |
|---|
| MITRE ATT&CK | T1485 - Data Destruction |
|---|
| ATTACK PATH | Internet → Key Vault Public Endpoint → Secrets/Keys/Certs |
|---|
| PATH LENGTH | 1 hops |
|---|
| BLAST RADIUS | 1 key_vault(s): kv-titandemo-260426-1324 |
|---|
| COMPOUND RISK | 1 other finding(s) on the same resource — multiplier 1.5x |
|---|
| DETECTED AT | 2026-04-26T13:27:04.8954452-05:00 |
|---|
| FIX APPLIED | False |
|---|
REMEDIATION PLAYBOOK · OWNER: Security · ESTIMATED EFFORT: 30 minutes
- Enable purge protection: Update-AzKeyVault -EnablePurgeProtection
- Confirm soft-delete is also on (cannot disable once purge protection is set)
- Document the irreversibility for ops team
- Re-scan
TITAN AI · Live Azure scan against rg-titandemo-260426-1324 · AZL-20260426-132706